Skip to main content
Solved

Linux Syslog Filtering Function Fails For Non /24 Subnets

  • February 7, 2026
  • 5 replies
  • 5 views
P
This message originated from Cribl Community Slack.
Click here to view the original link.

trying to drop a bunch of netbios noise from linux syslog and while my function PROTO === "UDP" && (DST.endsWith(".255") || DPT === 137) works, it doesn't account for non /24 subnets, any advice?

Best answer by freimer749

MAC destination is always FF:FF:FF:FF:FF:FF for broadcast, regardless of IP/subnet.

5 replies

P
  • pmcintire228
  • Author
  • New Participant
  • February 7, 2026
message:
IN=ens192 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:56:aa:01:e1:08:00 SRC=10.40.198.57 DST=10.40.198.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=6807 PROTO=UDP SPT=137 DPT=137 LEN=58
P
  • pmcintire228
  • Author
  • New Participant
  • February 7, 2026
no subnet mask :disappointed:
F
  • freimer749
  • New Participant
  • Answer
  • February 7, 2026
MAC destination is always FF:FF:FF:FF:FF:FF for broadcast, regardless of IP/subnet.
P
  • pmcintire228
  • Author
  • New Participant
  • February 7, 2026
Ah good catch ty!
P
  • pmcintire228
  • Author
  • New Participant
  • February 7, 2026
PROTO == "UDP" && (MAC.startsWith("ff:ff:ff:ff:ff:ff") && DPT == "137")
Terms & ConditionsAccessibility statement